REST API JSON ouput corrupted (project listing) about gitiles HOT 2 CLOSED

This is probably on purpose, Gerrit also includes this prefix on its JSON 
output to prevent injection in scripts.

Indeed, working as intended. Many JSON libraries support adding a special 
prefix to make the returned source non-executable in order to prevent XSSI 
attacks; see for example 
https://code.google.com/p/google-gson/issues/detail?id=42

This prefix is always constant for Gitiles, so you can strip the first 5 bytes 
of the output. Or up to the first newline, your choice.